fix(types): publish portable declarations without private source aliases

Related source-first framework gate: https://github.com/stacksjs/stacks/issues/2958. Blocks qualified dependency adoption for https://github.com/stacksjs/the-settlers-iii-remake/issues/25.

A normal isolated public install of bun-query-builder@0.3.34 fails strict TypeScript consumption of the package root. Exact source/tag: 6b7d73439f38676ba579f04cf1d65fe5e6d5d176 / v0.3.34. Source CI41495624018 and normal Releaser41495623928 are green, but that does not establish portable published types.

Reproduction, with ordinary Bun1.4.4 installation, no lifecycle trust override and no source aliases:

{"dependencies":{"bun-query-builder":"0.3.34"},"devDependencies":{"@types/bun":"1.3.14"}}

consumer.ts imports and reexports the published root's defineModel. The consumer config sets paths:{}, strict:true, skipLibCheck:false, noEmit:true, moduleResolution:"Bundler". Existing TypeScript7 compiler exits2 with exactly seven TS2307 Cannot find module diagnostics:

• dist/actions/db-info.d.ts:1, db-optimize.d.ts:1, db-wipe.d.ts:1, migrate-generate.d.ts:1, migrate.d.ts:1 import @/types.
• dist/actions/migrate.d.ts:2 imports @/migrations.
• dist/actions/seed.d.ts:1 imports @/seeder.

The public root reexports actions/index, which reaches these declarations. These are real import statements, not documentation examples. No corresponding dependency or package import map exists. The private aliases come from the owning root tsconfig's @/* mapping to package src/*.

Integrity and source were independently checked first: original public301241byte archive SHA256 ac0986541d441b234725ad5f79e70c93cffb4a1abcfa99a021d0d8bbe7e3c2fd, SHA1 90b31775fc32e3bd4ccd963d75c411abe4792148, registry SHA512/SRI and original accepted publication artifact13165758752 all match. All89 installed files match the original tar with no extras. Normal install and frozen install exit0. Default Bun blocked one transitive postinstall; no trust override was used. The strict compiler failure is independent of lifecycle execution.

Public 0.3.35, peeled source f1c16d4c0c48ebae2a34efd3289210e9a9423072, retains the same seven imports; its real tar hashes/CRC/safe members were checked. It must not be assumed fixed.

Acceptance:

• Fix the owning declaration-generation boundary, then consume the released generator/plugin in this package through normal tooling. build.ts currently uses bun-plugin-dtsx with dts({root:"./src",entrypoints:[...]}); the plugin delegates to the shared dtsx generator. Track the reusable emitter repair separately.
• Add a maintained real packed/public-package consumer regression with empty consumer paths and skipLibCheck:false; ensure the root/browser/runtime/dynamodb declaration graphs are portable. Retain the original public red.
• Keep declared external packages external, and preserve actual model/runtime APIs. No private consumer aliases, node_modules edits, manual declaration rewriting, skipped type checks or downgraded dependency floors.
• Run owning source checks, release normally, verify exact required CI/Releaser and actual public accepted archive/provenance identity, then repeat normal/frozen isolated strict consumption before downstream adoption.

Evidence is retained under /tmp/bun-query-builder-0.3.34-verification, including original source/API/archive/publication artifact and strict-consumer logs. Registry-served SLSA subject/source/run association was checked; no independent Sigstore trust-chain claim. No npm package runtime/CLI execution or owning source edit has been performed in this investigation.

Owning reusable emitter repair: https://github.com/stacksjs/dtsx/issues/3134. This package delivery is blocked by that source correction and its verified release, followed by an actual query-builder rebuild/release/public strict consumer.